From 7d2cff473c42bae15a79279ab9b3ce37f5ebee12 Mon Sep 17 00:00:00 2001 From: Dirk Wetter Date: Fri, 16 Oct 2026 11:24:35 +0200 Subject: [PATCH] revise phrases --- SECURITY.md | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index c3f16449..0a44a6c4 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,21 +2,18 @@ ## Reporting a Vulnerability -This project takes security seriously —this is meant literally —not like some companies claim after a breach or other security incident. +This project takes security seriously —this is meant literally —not like some companies claim after a breach or other security incident. -The attack surface of testssl.sh is quite small and thus there should not be any serious blunders. We followed recommended security practises, e.g. like validate inputs and a lot more. +The attack surface of testssl.sh is quite small and thus there should not be any serious blunders. We followed recommended security practices, e.g. validate inputs and more. -However this project was made by humans and despite our dedication there could be still security bugs. If you find one and the impact is not low, please use [Responsible -Disclosure](https://en.wikipedia.org/wiki/Full_disclosure_(computer_security)#Coordinated_vulnerability_disclosure), see -[github docs](https://docs.github.com/en/enterprise-cloud@latest/code-security/how-tos/report-and-fix-vulnerabilities/report-privately) and report them *privately* . If you happen -to have a PoC, it will be much appreciated but it is not mandatory. Using [Full Disclosure](https://en.wikipedia.org/wiki/Full_disclosure_(computer_security)#Full_disclosure) might be a problem for the people setting up a website using testssl.sh as a scanner or users. -Also keep in mind that the maintainers here have a professional attitude but this project, it is a spare time project. +However this project was made by humans and despite our dedication and diligence there could be still security bugs. If you find one and the impact is not low, please use [Responsible +Disclosure](https://en.wikipedia.org/wiki/Full_disclosure_(computer_security)#Coordinated_vulnerability_disclosure), see [github docs](https://docs.github.com/en/enterprise-cloud@latest/code-security/how-tos/report-and-fix-vulnerabilities/report-privately) and report them *privately* . If you happen to have a PoC, it will be much appreciated but it is not mandatory. Using [Full Disclosure](https://en.wikipedia.org/wiki/Full_disclosure_(computer_security)#Full_disclosure) might be a problem everywhere where testssl.sh is being used -- just for for CLI users, maintainers of CI/CD or monitoring environment or for people using testssl.sh as a scanner on their website. -### How do I do that? +Also keep in mind that the maintainers here have a professional attitude but this project is volunteer work. -"Create new Issue" --> "Report a security vulnerability" . Then on the LHS you should see "Advisory" which you need to fill out. That stays private until we fixed your point or disregard it. +### How do I file a problem? -The UI is not very intuitive, thus if that doesn't work file a public issue that **this doesn't work**. +"Create new Issue" --> "Report a security vulnerability" . Then on the LHS you should see "Advisory" which you need to fill out. That stays private until we fixed your point or, if your point has no impact, disregard it. ## Supported Versions